Live › vulnerability › CVE-2026-90871
WS_FTP Server on Windows fails to keep file paths inside their intended directory. An unauthenticated attacker can affect files outside that directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
WS_FTP Server installations on Windows older than 2024.0.7 or 2025.0.4 are in scope. The sources do not describe any non-default configuration that is required.
No product ranges from the sources yet.
2024.0.7 or later on the 2024 line2025.0.4 or later on the 2025 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-90871")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.